Privacy Policy for Job Applicants

Privacy Policy for Job Applicants (“Careers”)

This policy outlines how the companies within the GCR Group (GCR PLASTIC SOLUTIONS S.L.U and affiliated companies) handle the personal data of individuals applying for positions within these entities during and until the conclusion of the selection process in which they participate.

I. Who is responsible for the collected data?

The entity responsible for processing the personal data is the hiring company conducting the selection process, as specified in the job posting and/or selection process.
Applicants may contact the data controller via email at [email protected] for any questions or requests regarding personal data protection.
The GCR Group is committed to ensuring compliance with data protection regulations concerning the processing of applicants’ personal data across all member companies of the Group.

II. What type of data do we process?

The personal data processed for job applicants includes:
– Identifying information (e.g., name, surname, nationality) and contact details (e.g., email address and phone number).
– Academic and professional information (e.g., CV).

All of the above data is directly obtained from applicants when submitting their CV and other details as part of the application process.

III. Why do we process your personal data?

We process your data to manage the recruitment process, verify compliance with the required qualifications/skills for the role, and evaluate the applicant’s suitability. If an applicant is selected, the data is also used to facilitate their onboarding process with the hiring company.

IV. Lawful basis for processing

The legal basis for processing personal data is the pursuit of the legitimate interests of the GCR Group companies, as established in Article 6(1)(f) GDPR. Specifically, this involves using personal data to evaluate whether the required qualifications for employment are met and to assess the suitability of the applicant participating in the selection process, which they join freely and voluntarily. Additionally, personal data may be retained to maintain a list of potentially suitable candidates for future vacancies.
If the application is retained, the data will also be processed for the purpose of signing the subsequent employment contract (in accordance with Article 6(1)(b) GDPR).

V. Who do we share your data with?

Access to the personal data collected during the selection process is limited to authorized personnel of the hiring company.
The GCR Group’s Human Resources department is responsible for processing all candidates’ personal data.
Personal data may also be shared with IT service providers, government and judicial authorities as required by law or in connection with legal proceedings, and external advisors (e.g., lawyers) when necessary or appropriate to exercise legal rights or defend against claims.

VI. How long do we keep the data?

Personal data will be retained for one (1) year unless the applicant is hired, in which case the data will be processed in accordance with the Group’s employee privacy policy.

VII. Security measures

The companies within the GCR Group are committed to protecting personal data and ensuring privacy. Your data will always be treated with absolute confidentiality and in compliance with the duty of secrecy.
To this end, necessary technical and organizational measures are implemented to ensure the security of your data and prevent alteration, loss, unauthorized processing, or access. The data controller will inform those who access the data of their security obligations (confidentiality and secrecy) and their duty to maintain discretion.

VIII. Your rights

Under current data protection regulations, you have the right to access your data and obtain a copy, the right to rectification, the right to erasure, the right to restrict processing, the right to object to processing, and the right to data portability (Articles 15 et seq. GDPR).
To exercise your rights, you may send an email to [email protected]. We will provide information regarding actions taken in response to your request as soon as possible and, in any case, within one month of receiving your request. This period may be extended by an additional two months if necessary, considering the complexity and number of requests. We will inform you of any such extension within one month of receiving your request, along with the reasons for the delay.
If you do not wish for your data to be retained, you may notify us at any time by emailing [email protected].

IX. Contact

If you have any questions regarding the processing of your personal data, please contact us at [email protected].
Finally, you have the right to lodge a complaint with the competent data protection authority, particularly the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es/en.

October 2024